Cisco bundles dozens of IOS XR flaws into urgent security update release

Cisco's security team identified a large set of bugs during an internal audit of its IOS XR operating system, prompting the company to bundle the fixes into a single software release. Among the findings are three critical vulnerabilities—CVE-2026-20274, CVE-2026-20279, and CVE-2026-20212—each rated 9.8 on the CVSS scale, covering buffer overflows, improper access control, and insecure default settings. An additional suite of high-severity flaws received scores ranging from 8.2 to 8.8.

The most serious is CVE-2026-20212, which stems from a faulty integration with Cisco's Silicon One processors and could let an attacker gain root access on ten Nexus 9000 Series switches via TCP ports 43210 and 43211. Cisco has published updated IOS XR releases that resolve the critical bugs and urges immediate adoption. Because a permanent software fix for the Nexus issue is not yet available, the company recommends applying infrastructure ACLs to block the vulnerable ports as a temporary mitigation.